CVE-2026-18958

A vulnerability was detected in sambitraj Student-Management-System. Unknown functionality of the Dashboard component allows manipulation of roll_no/teacher_name arguments, leading to SQL injection. The attack can be executed remotely, and the exploit is now public.

A vulnerability in imranrisal-dev Student-Management-System allows unrestricted file upload via the storeProfileImage function in student_profile_pic.php. An attacker can remotely manipulate the choose_file argument to upload arbitrary files. The exploit has been publicly disclosed and may be utilized.

A weakness has been identified in imvks786 student_management_system up to commit 9599b560ad3c3b83e75d328b76bedcd489ef1f46. An unknown function in the file /add.php of the Student Record Handler component is affected. Executing a manipulation can lead to improper access controls. The attack may be performed remotely. The exploit has been made public and could be used for attacks. The project uses a rolling release system, so version information is not disclosed. The project was informed but has not responded.

An improper authorization vulnerability was detected in Kushan2k student-management-system up to commit f16a4ceaddd6729c4b306ed4641cda3176c1ef2a in the edit-admin function of controllers/AdminController.php in the Profile Update Endpoint component via manipulation of the isadmin argument. The attack can be carried out remotely, and the exploit has been publicly disclosed. The product follows a rolling release model, so no version is provided.

Kushan2k student-management-system up to commit f16a4ce has an unrestricted file upload vulnerability in service/RegisterService.php via the stimg argument. The attack can be performed remotely, and the exploit is publicly available. The project has not responded.

Student-Management-System up to commit f0c5f6842c5e8c431ff02b5260a565ca844df3a0 has a vulnerability in admin/deleteform.php where the sid argument leads to improper authorization.

Vulnerability in Student-Management-System (a4m4) up to commit f0c5f6842c5e8c431ff02b5260a565ca844df3a0. An unknown function in admin/ allows execution after redirect (open redirect). Remote attack possible.

A cross-site scripting vulnerability was found in sambitraj STUDENT-MANAGEMENT-SYSTEM 1.0 on the Dashboard page. Manipulating the Name argument allows remote script execution. The exploit is public, and the project has not responded.

In sambitraj STUDENT-MANAGEMENT-SYSTEM 1.0, an SQL injection vulnerability was found in the Login Page component. Manipulating the email argument leads to SQL injection. The attack can be performed remotely, and an exploit has been published. The project was informed early but has not responded.

Vulnerability in STUDENT-MANAGEMENT-SYSTEM (up to commit 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5) in the Dashboard component, leading to improper access controls. The attack can be performed remotely, and the exploit is publicly available.